apache / apache/maven-toolchains-plugin
No timeout for external java process in doGetToolchainModel
- Dominant language
- Java
- Stars
- 27
- Forks
- 31
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
launches a subprocess and calls without a timeout. A hung or slow JVM process will block Maven indefinitely.
## Location
https://github.com/apache/maven-toolchains-plugin/blob/master/src/main/java/org/apache/maven/plugins/toolchain/jdk/ToolchainDiscoverer.java#L243-L250
## Code
## Problem
without arguments blocks forever until the process completes. If the discovered JDK's java binary is:
- A script that hangs
- A broken/corrupted installation
- An interactive shell
- Extremely slow (e.g., on a network filesystem)
Maven will hang indefinitely with no way to recover other than killing the process.
## Impact
During JDK toolchain discovery, a single problematic JDK installation can cause the entire Maven build to hang permanently. Since discovery scans many directories (including user-controlled paths like , , etc.), a corrupted or slow JDK in any of these locations blocks the build.
## Suggested Fix
Use with a reasonable timeout (e.g., 30 seconds), and if the process times out, destroy it and log a warning:
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/main/java/org/apache/maven/plugins/toolchain/jdk/ToolchainDiscoverer.java at lines 243-250 and inspect how doGetToolchainModel launches the external Java process. Add bounded process handling with cleanup and a warning on timeout, then verify that a hung or slow JDK no longer blocks toolchain discovery.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100